HAProxy HSTS Preloading

[michaelschefczyk]

Dear All,

The option to enable HSTS (HTTP strict transport security, https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security) in HAProxy is very good, I think. A slight step further should be the use of HSTS preloading (https://hstspreload.appspot.com/). That, however requires the HSTS header containing not only "max-age", as the HAProxy package does nicely generate, but also "includeSubDomains; preload". Would it be reallistic to include these options in the package?

Regards,

Michael Schefczyk

[PiBa]

Hi Michael,

It would indeed be a step further, but i think its a rather 'dangerous' option if i understand it correctly..If you dont think it through you might loose access to http only sites on the same domain that you/someone forgot where running as well.. Ill put it on my todo list though.

Regards,
PiBa-NL